Actively exploited Microsoft zero-days patched in February security updates

Microsoft disclosed and patched multiple actively exploited vulnerabilities as part of its February security updates, including a Microsoft Word security feature bypass tracked as CVE-2026-21514. The Word flaw (CVSS 7.8; CWE-807) allows attackers to bypass Object Linking and Embedding (OLE)-related mitigations by abusing how Word makes security decisions based on untrusted inputs; exploitation is described as requiring a crafted document and user interaction (e.g., opening a phishing-delivered file) while avoiding typical prompts such as Protected View or “Enable Content” warnings.

Microsoft also addressed an in-the-wild exploited Windows Desktop Window Manager (dwm.exe) elevation-of-privilege vulnerability, CVE-2026-21519 (CVSS 7.8), which can allow a local attacker to escalate from a standard user context to SYSTEM. The February update review also lists additional exploited issues patched in the same release, including security feature bypasses in Windows Shell (CVE-2026-21510) and Internet Explorer (CVE-2026-21513), plus other exploited vulnerabilities (e.g., Windows Remote Desktop Services EoP CVE-2026-21533), underscoring that defenders should prioritize rapid deployment of the February fixes across affected Windows and Office estates.